OpenVPN 2.7.9 fixes two Windows-specific security issues: CVE-2026-121720 tightens validation of values passed from the service to the main program, and CVE-2026-115342 improves command-line argument parsing across the main program and interactive service.
The release also adds Linux IFF_BACKPRESSURE support where available.
What is being fixed in Windows
The OpenVPN service now more strictly checks certain values it sends to the main program to prevent unsafe values from passing through. It also more reliably checks commands and accompanying information when quotes are in the wrong places.
Files needed by program add-ons are now restricted to trusted folders. Programs launched through the service are also better protected, making it harder for their memory and operation to be corrupted.
Changes to traffic management in Linux
When the program does not have time to process incoming traffic, the Linux network subsystem can now prioritize it and manage it through queues, instead of discarding the relevant data, as it did previously.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
How a simple file can disable your Android phone
↗
The release also changes how OpenVPN updates existing network interfaces on Linux.
Usernames and other corrections
Fixed an issue that could carry part of an overly long username into the password field. The admin screen can now give a username that is already known when asking for a password. This allows compatible applications to complete the name or ask for just the password. Compatibility level 6 or higher is required for this to work.
OpenVPN also fixed memory leaks in the Windows service and issues with IPv6 addresses for DNS that are automatically provided by the network. It also fixed the display of gateway information, which was missing from the network route output. It addressed potential program crashes and resource leaks, as well as issues with access checks for additional certificate files.
The program now more systematically cleans sensitive digital keys and secrets used for identity verification from memory. The management of certificate revocation lists has also been improved, while OpenVPN prevents the recording of port sharing logs via links leading to other files. The release also includes changes for cooperation with OpenSSL 4.1.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)